@stamhoofd/backend 2.137.4 → 2.138.0

package/src/services/VerificationCodeService.ts

@@ -0,0 +1,101 @@
+import type { I18n } from '@stamhoofd/backend-i18n';
+import type { Organization } from '@stamhoofd/models';
+import { EmailVerificationCode, Platform, User } from '@stamhoofd/models';
+import { sendEmailTemplate } from '../helpers/EmailBuilder.js';
+import { EmailTemplateType, getAppHost, Recipient, Replacement } from '@stamhoofd/structures';
+
+/**
+ * Sends the verification emails for an EmailVerificationCode. The code itself is generated, stored
+ * and verified on the model.
+ */
+export class VerificationCodeService {
+    static getEmailVerificationUrl(code: EmailVerificationCode, user: User, organization: Organization | null, i18n: I18n) {
+        const host = getAppHost('verify-email', organization, !!user.permissions, i18n);
+        return 'https://' + host + '?code=' + encodeURIComponent(code.code) + '&token=' + encodeURIComponent(code.token) + '&email=' + encodeURIComponent(code.email);
+    }
+
+    static async send(code: EmailVerificationCode, user: User, organization: Organization | null, i18n: I18n, withCode = true) {
+        const url = this.getEmailVerificationUrl(code, user, organization, i18n);
+
+        const name = organization?.name ?? (await Platform.getSharedPrivateStruct()).config.name;
+
+        const replacements: Replacement[] = [
+            Replacement.create({
+                token: 'organizationName',
+                value: name,
+            }),
+            Replacement.create({
+                token: 'confirmEmailUrl',
+                value: url,
+            }),
+        ];
+
+        if (withCode) {
+            const formattedCode = code.code.substr(0, 3) + ' ' + code.code.substr(3);
+
+            await sendEmailTemplate(organization, {
+                recipients: [
+                    Recipient.create({
+                        email: code.email,
+                        replacements: [
+                            ...replacements,
+                            Replacement.create({
+                                token: 'confirmEmailCode',
+                                value: formattedCode,
+                            }),
+                        ],
+                    }),
+                ],
+                template: {
+                    type: EmailTemplateType.VerifyEmail,
+                },
+                type: 'transactional',
+            });
+        } else {
+            await sendEmailTemplate(organization, {
+                recipients: [
+                    Recipient.create({
+                        email: code.email,
+                        replacements,
+                    }),
+                ],
+                template: {
+                    type: EmailTemplateType.VerifyEmailWithoutCode,
+                },
+                type: 'transactional',
+            });
+        }
+    }
+
+    static async resend(organization: Organization | null, token: string, i18n: I18n) {
+        const verificationCodes = await EmailVerificationCode.where({
+            token,
+            organizationId: organization
+                ? {
+                        sign: 'IN',
+                        value: [organization.id, null],
+                    }
+                : null,
+        }, { limit: 1 });
+
+        if (verificationCodes.length == 0) {
+            console.log("Can't resend code, no coded found for token", token);
+            // TODO: maybe send a note via email
+            return;
+        }
+
+        const verificationCode = verificationCodes[0];
+
+        if (verificationCode.expiresAt < new Date()) {
+            // Don't report error, could be brute forced
+            console.log("Can't resend code, token is expired", token);
+            return;
+        }
+
+        const user = await User.getByID(verificationCode.userId);
+        if (!user) {
+            return;
+        }
+        await this.send(verificationCode, user, organization, i18n);
+    }
+}

package/tests/e2e/api-rate-limits.test.ts

@@ -29,7 +29,7 @@ describe('E2E.APIRateLimits', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await Token.createToken(user, new Date());
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({

package/tests/e2e/documents.test.ts

@@ -12,6 +12,7 @@ import { testServer } from '../helpers/TestServer.js';
 import { initAdmin } from '../init/initAdmin.js';
 import { initStripe } from '../init/initStripe.js';
 import { registrationUpdateQueue } from '../../src/services/BalanceItemService.js';
+import { DocumentRenderService } from '../../src/services/DocumentRenderService.js';
 import { initMembershipOrganization } from '../init/initMembershipOrganization.js';
 
 const baseUrl = `/members/register`;
@@ -119,7 +120,7 @@ describe('E2E.Documents', () => {
         const document = await Document.select().where('registrationId', registration.id).first(false);
         expect(document).not.toBeNull();
 
-        const html = await document!.getRenderedHtml(organization);
+        const html = await DocumentRenderService.getRenderedHtml(document!, organization);
 
         const registrationModel = (await Registration.getByID(registration.id))!;
 

package/tests/e2e/private-files.test.ts

@@ -1,7 +1,7 @@
 import { File, MemberDetails, MemberWithRegistrationsBlob, RecordCategory, RecordFileAnswer, RecordSettings, RecordType, TranslatedString, Version } from '@stamhoofd/structures';
 
 import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
-import { PatchableArray } from '@simonbackx/simple-encoding';
+import { encodeObject, EncodeMedium, PatchableArray } from '@simonbackx/simple-encoding';
 import { Request } from '@simonbackx/simple-endpoints';
 import { Member, OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
 import { PermissionLevel, Permissions } from '@stamhoofd/structures';
@@ -62,7 +62,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const privateFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,
@@ -105,7 +105,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const privateFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,
@@ -149,7 +149,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const privateFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,
@@ -188,6 +188,69 @@ describe('E2E.PrivateFiles', () => {
         expect(answer.file!.signedUrl).toBeTruthy();
     });
 
+    test('Cannot set a public file with a url a browser would run as code', async () => {
+        const organization = await createOrganization();
+
+        const user = await new UserFactory({
+            organization,
+            permissions: Permissions.create({
+                level: PermissionLevel.Full,
+            }),
+        }).create();
+        const token = await Token.createToken(user);
+
+        // Public files are not signed, so a malicious user can put anything in them. The url of a file ends up
+        // in a link (and in the source of an image), so a javascript: url would run on our own domain.
+        const buildBody = (server: string) => {
+            const member = MemberWithRegistrationsBlob.create({
+                details: MemberDetails.create({
+                    firstName: 'John',
+                    lastName: 'Doe',
+                }),
+            });
+
+            member.details.recordAnswers.set(recordSettings.id, RecordFileAnswer.create({
+                file: new File({
+                    id: 'test',
+                    server: 'https://replace-me.example.com',
+                    path: 'test.pdf',
+                    size: 100,
+                    isPrivate: false,
+                }),
+                settings: recordSettings,
+            }));
+
+            const arr = new PatchableArray() as PatchableArrayAutoEncoder<MemberWithRegistrationsBlob>;
+            arr.addPut(member);
+
+            // An attacker doesn't use our client, so build the request body they would send instead
+            const encoded = encodeObject(arr, { version: Version, medium: EncodeMedium.Network });
+            return JSON.parse(JSON.stringify(encoded).replaceAll('https://replace-me.example.com', server));
+        };
+
+        const attacks = [
+            { server: 'javascript:alert(document.domain)', error: /can only be http or https/i },
+            { server: 'data:text/html,<script>alert(1)</script>', error: /can only be http or https/i },
+            { server: 'not-a-url', error: /invalid url for a file/i },
+            { server: '', error: /invalid url for a file/i },
+        ];
+
+        for (const attack of attacks) {
+            const r = Request.buildJson('PATCH', baseUrl, organization.getApiHost(), buildBody(attack.server));
+            r.headers.authorization = 'Bearer ' + token.accessToken;
+
+            await expect(testServer.test(endpoint, r), attack.server).rejects.toThrow(attack.error);
+        }
+
+        // ... and our own code can never store one either
+        expect(() => Request.buildJson('PATCH', baseUrl, organization.getApiHost(), new File({
+            id: 'test',
+            server: 'javascript:alert(document.domain)',
+            path: 'test.pdf',
+            size: 100,
+        }))).toThrow(/can only be http or https/i);
+    });
+
     test('Can set public files', async () => {
         const organization = await createOrganization();
 
@@ -211,7 +274,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const publicFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: false,
@@ -275,7 +338,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const maliciousFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,
@@ -355,7 +418,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const maliciousFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,
@@ -418,7 +481,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -447,7 +510,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -481,7 +544,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -509,7 +572,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -537,7 +600,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -564,7 +627,7 @@ describe('E2E.PrivateFiles', () => {
             // access to the signed URL. This should not be possible without a valid signature
             const privateFile = new File({
                 id: 'test',
-                server: 'test.com',
+                server: 'https://test.com',
                 path: 'test.txt',
                 size: 100,
                 isPrivate: true,
@@ -613,7 +676,7 @@ describe('E2E.PrivateFiles', () => {
         // access to the signed URL. This should not be possible without a valid signature
         const maliciousFile = new File({
             id: 'test',
-            server: 'test.com',
+            server: 'https://test.com',
             path: 'test.txt',
             size: 100,
             isPrivate: true,

package/tests/helpers/MFATestHelper.ts

@@ -0,0 +1,42 @@
+import type { User } from '@stamhoofd/models';
+import { MFATOTP } from '@stamhoofd/models';
+import { authenticator } from 'otplib';
+
+import { RecoveryCodeHelper } from '../../src/helpers/RecoveryCodeHelper.js';
+import { TOTPHelper } from '../../src/helpers/TOTPHelper.js';
+
+/**
+ * Set up two-factor authentication in tests, without going through the enrollment flow.
+ * Also used by the Playwright tests, which drive the real UI but need to know the secret
+ * of an authenticator app to generate its codes.
+ */
+export const MFATestHelper = {
+    /**
+     * Enroll a confirmed authenticator app and return its plaintext secret.
+     */
+    async addConfirmedTOTP(user: User, name = 'Test authenticator'): Promise<{ id: string; secret: string }> {
+        const totp = new MFATOTP();
+        const secret = authenticator.generateSecret();
+        totp.userId = user.id;
+        totp.name = name;
+        totp.secret = TOTPHelper.encrypt(secret);
+        totp.confirmedAt = new Date();
+        await totp.save();
+        return { id: totp.id, secret };
+    },
+
+    /**
+     * The code an authenticator app would show right now for this secret.
+     */
+    generateTOTPCode(secret: string): string {
+        return authenticator.generate(secret);
+    },
+
+    /**
+     * Whether this recovery code is one of the user's valid codes. Consumes it, just like
+     * using it to log in would.
+     */
+    async useRecoveryCode(userId: string, code: string): Promise<boolean> {
+        return await RecoveryCodeHelper.consume(userId, code);
+    },
+};

package/tests/helpers/TestServer.ts

@@ -3,12 +3,16 @@ import { VersionMiddleware } from '@stamhoofd/backend-middleware';
 import { Version } from '@stamhoofd/structures';
 
 import { ContextMiddleware } from '../../src/middleware/ContextMiddleware.js';
+import { TenantScopeMiddleware } from '../../src/middleware/TenantScopeMiddleware.js';
 import { FileSignService } from '../../src/services/FileSignService.js';
 
 export const testServer = new TestServer();
 
 // Contexts
 testServer.addRequestMiddleware(ContextMiddleware);
+
+// Registration order mirrors boot.ts
+testServer.addRequestMiddleware(TenantScopeMiddleware);
 testServer.addResponseMiddleware(FileSignService);
 testServer.addRequestMiddleware(FileSignService);
 

package/tests/helpers/index.ts

@@ -1,3 +1,4 @@
+export * from './MFATestHelper.js';
 export * from './MollieMocker.js';
 export * from './PayconiqMocker.js';
 export * from './StripeMocker.js';

package/tsconfig.build.json

@@ -8,7 +8,8 @@
         "./index.ts",
         "./migrations.ts",
         "./src",
-        "../../stamhoofd.d.ts"
+        "../../stamhoofd.d.ts",
+        "./src/**/*.json",
     ],
     "exclude": [
         "./src/**/*.spec.ts",